Microsoft’s July 2025 Patch Tuesday includes a fix for a critical wormable remote code execution (RCE) vulnerability, tracked as CVE-2025-47981, affecting Windows and Windows Server. Security experts are also warning organizations to monitor for CitrixBleed 2 (CVE-2025-5777) exploitation, as PoC exploits are now public and attacks have been observed even against patched systems.
Source: Help Net Security
Massive Data Breach: McDonald’s AI Hiring Tool Exposes Data of 64 Million Applicants
Researchers uncovered a series of security flaws in McDonald’s McHire AI chatbot, exposing sensitive personal information of up to 64 million job applicants. Issues included insecure APIs and use of default admin credentials, leading to unauthorized access to applicant data before the vulnerabilities were patched.
Source: Security Affairs
Critical RCE in Wing FTP Server Exploited Within 24 Hours of Disclosure
Security researchers observed active exploitation of a CVSS 10-rated RCE vulnerability in Wing FTP Server just one day after details became public. Organizations using this popular file transfer solution are urged to patch immediately to mitigate risk, as the flaw is being used for rapid compromise and is now actively exploited in the wild.
Source: CISO2CISO / The Register
GPUHammer: New RowHammer Variant Targets NVIDIA GPUs, Threatening AI Model Integrity
Researchers have demonstrated 'GPUHammer', a new variant of the RowHammer attack capable of degrading AI models on NVIDIA GPUs by corrupting memory. NVIDIA recommends enabling system-level Error Correction Codes (ECC) to mitigate this threat, as the risk depends on the DRAM device, platform, and configuration.
Source: The Hacker News
Over 600 Laravel Apps Vulnerable to RCE Due to Leaked APP_KEYs on GitHub
More than 600 applications built with the Laravel framework are at risk of remote code execution after their APP_KEY secrets were found leaked publicly on GitHub. The APP_KEY, vital for encrypting sensitive data, can be leveraged by attackers to exploit a deserialization flaw if obtained, highlighting the danger of poor secrets management.
Source: The Hacker News
Pay2Key Ransomware Gang Resurfaces with Incentives to Attack US, Israel
The Pay2Key ransomware group, previously dormant, has reemerged and is now offering incentives to target organizations in the US and Israel. This move underlines the evolving ransomware landscape and the increasing focus on geopolitical targets, potentially heralding a surge in attacks against high-profile Western organizations.
Source: CISO2CISO / Dark Reading
Three Major Data Breaches in Three Weeks Highlight Enterprise Security Gaps
Ingram Micro, UNFI, and McDonald’s all experienced significant security incidents over just three weeks, exposing critical gaps in enterprise security postures. These high-profile breaches emphasize the urgent need for enhanced cybersecurity strategies and accountability at the executive level.
Source: Forbes Security
You May Also Be Interested In...